Giters

0vercl0k / wtf

wtf is a distributed, code-coverage guided, customizable, cross-platform snapshot-based fuzzer designed for attacking user and / or kernel-mode targets running on Microsoft Windows and Linux user-mode (experimental!).

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

During bochscpu simulation, data from the heap is not fetched correctly.

g3un opened this issue · comments

commented

I don't know if it's a problem with the bochscpu code or the backend code, but there was a problem where the pointer in the heap could not be retrieved properly.

When opening a dump created with snapshot with windbg:

kd> dq rcx
00000204`b6e0b060  00007ff8`20a98f80 00007ff8`20a98f80
00000204`b6e0b070  00007ff8`20add720 00007ff8`20add720
00000204`b6e0b080  00d9f791`00000000 00000204`b6e0c5fe
00000204`b6e0b090  00000000`0000000e 00000204`b6e0bef0
00000204`b6e0b0a0  0000073e`00001000 00000204`b6e0cef0
00000204`b6e0b0b0  00000000`00001000 00000000`00000000
00000204`b6e0b0c0  00000000`00000000 000e0001`00000001
00000204`b6e0b0d0  00000204`b6e0befe 00000000`00000000

However, the first time rcx+48(0x00000204b6e0b0a8) is accessed in the Tenet trace is as follows:

image

The pc at that point is mov r8, [rbx+10h] and rbx is 0x204B6E0B098.

Do you know anything about cases where the lower 4 bytes are lost as shown above?

commented

Ah, I used the g_backend method incorrectly. sorry.

commented